mydoom | 11bbb46d8d2393b0739de8cc9f5adb110a35572cd870961e254aebcf7857d468

General

Target

11bbb46d8d2393b0739de8cc9f5adb110a35572cd870961e254aebcf7857d468.exe
Size

41KB
MD5

38f69b3990a92eb8478a0f1d0f8bc4f8
SHA1

67ed4b55a29414a014effd6bdda5f229de61c25d
SHA256

11bbb46d8d2393b0739de8cc9f5adb110a35572cd870961e254aebcf7857d468
SHA512

8b72a6df948e695b26ce01f2c34aeec1f802c15399fa83fa471b595e0d7fc04355d6793909b70c3552f83f1017535de5f4114b3d6b8dda0c4c4d5679fdf5f9cd
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/v:AEwVs+0jNDY1qi/qH

Score

10^/10

Malware Config

Signatures

Detects MyDoom family 5 IoCs

resource	yara_rule
behavioral2/memory/4120-13-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/4120-44-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/4120-120-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/4120-144-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/4120-148-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom

MyDoom
MyDoom is a Worm that is written in C++.
worm mydoom
Mydoom family
mydoom

Executes dropped EXE 1 IoCs

pid	Process
4556	services.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	11bbb46d8d2393b0739de8cc9f5adb110a35572cd870961e254aebcf7857d468.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

UPX packed file 21 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4120-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/files/0x000c000000023b9d-4.dat	upx
behavioral2/memory/4556-5-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4120-13-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/4556-15-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4556-16-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4556-21-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4556-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4556-28-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4556-33-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4556-38-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4556-40-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4120-44-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/4556-45-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/files/0x0005000000011940-55.dat	upx
behavioral2/memory/4120-120-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/4556-121-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4120-144-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/4556-145-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4120-148-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/4556-149-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\java.exe	11bbb46d8d2393b0739de8cc9f5adb110a35572cd870961e254aebcf7857d468.exe
File created	C:\Windows\services.exe	11bbb46d8d2393b0739de8cc9f5adb110a35572cd870961e254aebcf7857d468.exe
File opened for modification	C:\Windows\java.exe	11bbb46d8d2393b0739de8cc9f5adb110a35572cd870961e254aebcf7857d468.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	11bbb46d8d2393b0739de8cc9f5adb110a35572cd870961e254aebcf7857d468.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4120 wrote to memory of 4556	4120	11bbb46d8d2393b0739de8cc9f5adb110a35572cd870961e254aebcf7857d468.exe	82
PID 4120 wrote to memory of 4556	4120	11bbb46d8d2393b0739de8cc9f5adb110a35572cd870961e254aebcf7857d468.exe	82
PID 4120 wrote to memory of 4556	4120	11bbb46d8d2393b0739de8cc9f5adb110a35572cd870961e254aebcf7857d468.exe	82

C:\Users\Admin\AppData\Local\Temp\11bbb46d8d2393b0739de8cc9f5adb110a35572cd870961e254aebcf7857d468.exe
"C:\Users\Admin\AppData\Local\Temp\11bbb46d8d2393b0739de8cc9f5adb110a35572cd870961e254aebcf7857d468.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4120
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:4556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\X3JA8BBM\search[2].htm

Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Temp\fjhpfcypbl.log

Filesize
128B

MD5
f4a6697cbde61bf52fec6b0bd4546f79

SHA1
592af73d88f947e2e4b47aa5d72b5365036a597a

SHA256
462b21328a04f8ddc7a279ae9595da63e4afc433efb87a86e5299082dddddac9

SHA512
fb2b240f9299742a82aacdbdaf3bd09bb36814f258f8d4944153ca48786ef10bb4141af76920cd35f4bfbbe147b3ba4b07ea4e3f0f19219dfcf0176ee765d25e

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp7B9.tmp

Filesize
41KB

MD5
854c549b739006bfad3707efa581aaa9

SHA1
5417b27d2bf23e963c03b6b4d467326236e154f2

SHA256
b8a3ea0f1c4528598965705b6b0ff15f40cac52df7c0a27db5257c7172baccc7

SHA512
af2d4540b7683c5c1ddc7eaab6848534dac84232c1a9c7ec19ac454076ab0efde617ced5f638ec48573682c0d5f333a70d89fe313e6fda0bf78a08ba8540d2bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
160B

MD5
1f0a802088a4d2b59d8cb1f61a757e51

SHA1
85648348c9f5debd0a1e6903f991c9a500dcc05c

SHA256
02d47bf96d6fe5a278ef780bb975a084c7258bd7bb6f8d304b3c26139f9f2b35

SHA512
4242652d212c3133cb815dad4bca97862cdf1c031bdf2429ad73d6879c6b4147919bf599452b5695e063253bdb1d4f66142f9ae1c58417444eec56cd224e264f

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
160B

MD5
bb2ee99586caa59282fbcb2c75c229d5

SHA1
57a61f6c573b2e4853253629ee55a2ca98e43d67

SHA256
1aebec4af003f0b43e5a5238b2e9461a19acbf44ec18305407e4be4a9ea1b4af

SHA512
5e214638605d56832ad24e170252d8d729aa48e1da0bf2acfc334c6640a78311e723b0a9b1c10449548d0f25967d05e189cf8b15e678dfbb64fb188c41e0b21d

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/4120-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4120-144-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4120-120-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4120-13-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4120-148-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4120-44-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4556-16-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4556-40-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4556-45-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4556-38-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4556-33-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4556-28-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4556-121-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4556-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4556-21-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4556-15-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4556-145-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4556-5-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4556-149-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads